ci(release): push the release commit over SSH with a deploy key

[KaiSchwarz-cnic]

Part of RSRMID-2994 — this repository is the pilot.

What

• .releaserc.json: pins repositoryUrl to git@github.com:centralnicgroup-opensource/rtldev-middleware-php-sdk.git.
• docs/agents/ci-release.md: documents the new release-push auth and the two traps in it.

Why repositoryUrl is not optional

semantic-release's lib/get-git-auth-url.js expands shortcut URLs to HTTPS before it ever tries SSH:

if (info && info.getDefaultRepresentation() === "shortcut") {
    repositoryUrl = info.https();      // github:owner/repo  ->  https://...
}
await verifyAuth(repositoryUrl, branch.name, ...);

package.json carries "repository": "github:centralnicgroup-opensource/rtldev-middleware-php-sdk.git" — a shortcut. Without this override SSH is never attempted at all, and the deploy key on the runner goes unused.

What this buys

The @semantic-release/git push moves off RTLDEV_MW_CI_TOKEN — a personal account's PAT with admin over every repository in the organisation — and onto a deploy key scoped to this repository alone. That is what makes the default-branch-protection ruleset switchable on here: DeployKey is its only bypass actor, so the release push gets past it and nothing else does. Until now this repository carried releases-to-branch in the workspace register, meaning branch protection was withheld entirely for want of a bypass.

Unchanged on purpose

• GITHUB_TOKEN stays in the release step: @semantic-release/github creates the GitHub release with it, and .github/scripts/publish-docs.sh force-pushes gh-pages with it.
• The gh-pages push is not moved to the deploy key. The ruleset targets ~DEFAULT_BRANCH, so that push is not subject to it, and moving it would widen what the key is used for without removing a restriction.

Order

Merge after centralnicgroup-opensource/rtldev-middleware-shareable-workflows#104, which puts the key on the runner. Merging this first would point the push at SSH with no key present, and the release would fall back to HTTPS.

Then the workspace register PR, then scripts/org-settings.sh --apply php-sdk to create the ruleset, then a real release verified with DEBUG: semantic-release:get-git-auth-url.

🤖 Generated with Claude Code

[KaiSchwarz-cnic]

🎉 This PR is included in version 33.0.3 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀